CVE-2016-10033

PHPMailer CVE-2016-10033 affects the isMail transport in PHPMailer prior to 5.2.18, where an attacker can craft the Sender property to inject an extra parameter to the mail() call and achieve remote code execution on the web server. Related entries note the issue as a fix in PHPMailer versions 5....

CVE-2018-19296

PHPMailer (versions before 5.2.27 and 6.x before 6.0.6) is affected by an object injection vulnerability (CVE-2018-19296). The issue stems from how attachments may be processed, enabling an attacker to inject objects via crafted input, potentially leading to code execution. Patches were released ...

CVE-2020-36326

PHPMailer is affected in versions 6.1.8–6.4.0 by an object-injection vulnerability via Phar deserialization when using addAttachment with a UNC pathname. The issue arose after 6.1.8 fixed a UNC-path readability problem, unintentionally removing a block that previously prevented exploitation. Mult...

CVE-2016-10045

PHPMailer–CVE-2016-10045 affects the isMail transport in PHPMailer before 5.2.20. An improper interaction between escapeshellarg and internal escaping in the mail() function could allow remote attackers to pass extra parameters to the mail command and execute arbitrary code. This vulnerability ex...

CVE-2020-13625

PHPMailer prior to 6.1.6 contains an output escaping bug in attachment name handling when the file name includes a double quote, which can cause the file type to be misinterpreted by recipients or mail relays. The CVE is confirmed across multiple advisories and vendor responses (e.g., PHPMailer r...

CVE-2017-5223

CVE-2017-5223 affects PHPMailer before 5.2.22. The vulnerability arises in msgHTML, which transforms HTML and may convert relative image URLs to attachments using a base directory. If no base directory is provided, relative URLs become absolute local file paths, enabling local file disclosure whe...

CVE-2021-34551

PHPMailer prior to version 6.5.0 on Windows is vulnerable to remote code execution if lang_path is supplied from untrusted data and uses a UNC pathname. The root cause is loading language/translation files in a way that could execute code. Exploitation status is not detailed in the provided docum...

CVE-2021-3603

PHPMailer CVE-2021-3603 affects PHPMailer 6.4.1 and earlier, where validateAddress() could call an untrusted function named php if patternselect is 'php' and a global function php exists. This occurs when user-provided input injects such a function into the host project scope. The issue is mitiga...

CVE-2017-11503

PHPMailer 5.2.x contains a cross-site scripting vulnerability tracked as CVE-2017-11503 in the code_generator.php example, where user input was not properly filtered in the From Email Address and To Email Address fields. Affected release cited: PHPMailer 5.2.23. Public references in multiple juri...

CVE-2015-8476

PHPMailer CVE-2015-8476 describes CRLF injection vulnerabilities allowing arbitrary SMTP commands via CRLF in (1) an email address used in validateAddress() or (2) an SMTP command routed through sendCommand(). Affected versions are before 5.2.14. Public sources (Debian, Fedora advisories, GHSA) c...